⬢ DragonFlyBSD Kernel Audit
DF-1447 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
diff --git a/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c b/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c
--- a/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c
+++ b/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c
@@ -760,8 +760,7 @@
 			goto exit;
 		}
 		/* setup offsets for mode_11a next */
-		numEEPROMWordsPerChannel = wordsForPdgains[
-			pCal->pDataPerChannel[0].numPdGains - 1];
+		numEEPROMWordsPerChannel = (pCal->pDataPerChannel[0].numPdGains > 0 && pCal->pDataPerChannel[0].numPdGains <= nitems(wordsForPdgains)) ? wordsForPdgains[pCal->pDataPerChannel[0].numPdGains - 1] : 0;
 		off += pCal->numChannels * numEEPROMWordsPerChannel + 5;
 	}
 	if (ee->ee_Bmode) {
@@ -778,8 +777,7 @@
 			goto exit;
 		}
 		/* setup offsets for mode_11g next */
-		numEEPROMWordsPerChannel = wordsForPdgains[
-			pCal->pDataPerChannel[0].numPdGains - 1];
+		numEEPROMWordsPerChannel = (pCal->pDataPerChannel[0].numPdGains > 0 && pCal->pDataPerChannel[0].numPdGains <= nitems(wordsForPdgains)) ? wordsForPdgains[pCal->pDataPerChannel[0].numPdGains - 1] : 0;
 		off += pCal->numChannels * numEEPROMWordsPerChannel + 2;
 	}
 	if (ee->ee_Gmode) {